CVEs published in September 2025
4,150 vulnerabilities, 293 critical, 16 exploited.
- ibm security verify information queueIBM Security Verify Information Queue denial of service6.5 Medium
- ibm security verify information queueIBM Security Verify Information Queue code execution6.4 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal is vulnerable to Reflected XSS attack through get_editor path5.1 Medium
- chancmsyanyutao0402 ChanCMS getArticle CollectController server-side request forgery5.3 Medium
- mmaitre314 picklescanPickleScan Security Bypass Using Misleading File Extension9.3 Critical
- mmaitre314 picklescanPickleScan Security Bypass via Bad CRC in ZIP Archive9.3 Critical
- hoverflyHoverfly's WebSocket endpoint `/api/v2/ws/logs` reachable without authentication even when --auth is enabled.7.8 High
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal's Incorrect Authorization vulnerability can lead to guest users to obtaining sensitive data6.2 Medium
- chancmsyanyutao0402 ChanCMS Api.js search sql injection5.3 Medium
- hoverflyHoverfly vulnerable to remote code execution at `/api/v2/hoverfly/middleware` endpoint due to insecure middleware implementation9.8 Critical
- papermerge dmsPapermerge DMS Authorization Token improper authorization5.3 Medium
- isc storkDoS attack against the Stork UI from an unauthenticated user7.5 High
- mmaitre314 picklescanPickleScan Bypasses Unsafe Globals Check Using Submodule Imports9.3 Critical
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal and Liferay DXP vulnerable to Stored Cross-site Scripting4.6 Medium
- stalwartlabs stalwartStalwart vulnerable to Memory Exhaustion via CalDAV Event Expansion7.1 High
- dell powerprotect data managerDell PowerProtect Data Manager, version(s) 19.19 and 19.20, Hyper-V contain(s) a Path Traversal: ...4.4 Medium
- cisco ios xr softwareCisco IOS XR Address Resolution Protocol Broadcast Storm Vulnerability7.4 High
- cisco ios xr software, ios xr +1 moreCisco IOS XR Software Image Verification Bypass Vulnerability6.0 Medium
- cisco ios xr softwareCisco IOS XR Software Management Interface ACL Bypass Vulnerability5.3 Medium
- dell powerprotect data managerDell PowerProtect Data Manager, version(s) 19.19 and 19.20, Hyper-V contain(s) a Plaintext...5.0 Medium
- cern indicoIndico vulnerable to Cross-Site Scripting via LaTeX math code4.6 Medium
- cern indicoIndico may disclose unauthorized user details access via legacy API4.3 Medium
- pega platform, pegasystems pega infinity +1 morePega Platform versions 7.1.0 to Infinity 24.2.2 are affected by a Stored XSS issue in a user interface component5.5 Medium
- dell powerprotect data managerDell PowerProtect Data Manager, version(s) 19.19 and 19.20, Hyper-V contain(s) an Incorrect...7.0 High
- dell powerprotect data managerDell PowerProtect Data Manager, Generic Application Agent, version(s) 19.19 and 19.20, contain(s)...7.8 High
- dell powerprotect data managerDell PowerProtect Data Manager, version(s) 19.19 and 19.20, Hyper-V contain(s) an Improper...7.8 High
- dell powerprotect data managerDell PowerProtect Data Manager, version(s) 19.19 and 19.20, Hyper-V contain(s) an Improper...8.2 High
- dell powerprotect data managerDell PowerProtect Data Manager, Hyper-V, version(s) 19.19 and 19.20, contain(s) an Insertion of...8.8 High
- anthropic claude code, anthropics claude-code +1 moreClaude Code vulnerable to arbitrary code execution caused by maliciously configured git email8.7 High
- anthropic claude code, anthropics claude-code +1 moreClaude Code rg command had Command Injection that allowed bypass of user approval prompt for command execution8.7 High
- n-able n-centralN-central Incorrect Default Permissions could lead to Privilege Escalation7.0 High
- axxonsoft axxon one, axxonone c-werk +1 moreLack of Encryption in Object Archive in AxxonSoft Axxon One (C-Werk) before 2.0.85.1 Medium
- axxonsoft axxon one, axxonone c-werk +1 morePostgreSQL Upgrade from v10 to v17.4 in AxxonSoft Axxon One (C-Werk) 2.0.8 and earlier to Address Multiple Vulnerabilities9.3 Critical
- axxonsoft axxon one, axxonone c-werk +1 moreIncorrect Memory Allocation in OpenSSL-Based Session Module in AxxonSoft Axxon One (C-Werk)8.7 High
- axxonsoft axxon one, axxonone c-werk +1 moreIncorrect Evaluation of LDAP Nested Groups during Login in AxxonSoft Axxon One (C-Werk)5.3 Medium
- axxonsoft axxon one, axxonone c-werk +1 moreImproper Session Cleanup on Role Removal in Web Admin Panel in AxxonSoft Axxon One (C-Werk)5.3 Medium
- axxonsoft axxon one, axxonone c-werk +1 moreSensitive Information Disclosure in Diagnostic Dumps in AxxonSoft Axxon One VMS4.8 Medium
- axxonsoft axxon one, axxonnet arp agent c-werknet +1 moreHardcoded Password Exposure in AxxonNet (C-WerkNet) ARP Agent Logs6.7 Medium
- axxonsoft axxon one, axxonone c-werk +1 moreOutdated Third-Party NuGet Packages in AxxonSoft Axxon One VMS 2.0.0 through 2.0.49.3 Critical
- pixel prime resideo plugin for resideo - real estate wordpress themeResideo Plugin for Resideo - Real Estate WordPress Theme <= 2.5.4 - Authenticated (Subscriber+) Insecure Direct Object Reference to Privilege Escalation via Account Takeover8.8 High
- azon dominator php scriptReflected Cross-Site Scripting (XSS) in Azon Dominator5.1 Medium
- updfDLL search path hijacking vulnerability7.0 High
- updfDLL search path hijacking vulnerability7.0 High
- updfDLL search path hijacking vulnerability7.0 High
- grandstream networks waveDLL search order hijack in Wave by Grandstream Networks7.0 High
- solax power cloudSensitive Information Disclosure in SolaX Cloud8.7 High
- solax power cloudBypass of administrator login screen in SolaX Cloud6.3 Medium
- solax power cloudBypass of bruteforce protection in SolaX Cloud6.3 Medium
- solax power cloudDevice Takeover vulnerability in SolaX Cloud5.8 Medium
- curlpredictable WebSocket mask5.3 Medium
- Show moreLoading…